“Simply visiting the hacked site was enough for the exploit server to attack your device, and if it was successful, install a monitoring implant.”

Mr Beer and his team said they discovered attackers were using 12 separate security flaws in order to compromise devices. Most were bugs within Safari, the default web browser on Apple products.

‘Sustained effort’

Once on a person’s iPhone, the implant could access an enormous amount of data, including (though not limited to) contacts, images and GPS location data. It would relay this information back to an external server every 60 seconds, Mr Beer noted.

The implant also was able to scoop up data from apps a person was using, such as Instagram, WhatsApp and Telegram. Mr Beer’s list of examples also included Google products such as Gmail and Hangouts, the firm’s group video chat app.

The attackers were able to exploit “almost every version from iOS 10 through to the latest version of iOS 12”, Mr Beer added.

“This indicated a group making a sustained effort to hack the users of iPhones in certain communities over a period of at least two years.”

Apple’s fix

Google’s team notified Apple of the vulnerabilities on 1 February this year. A patch was subsequently released six days later to close the vulnerability. Apple’s patch notes refer to fixing an issue whereby “an application may be able to gain elevated privileges” and “an application may be able to execute arbitrary code with kernel privileges”.

Media playback is unsupported on your device

Media captionApple boss Tim Cook unveils new privacy protections

iPhone users should update their device to the latest software to make sure they are adequately protected.

Unlike some security disclosures, which offer merely theoretical uses of vulnerabilities, Google discovered this attack “in the wild” – in other words, it was in use by cybercriminals.

Mr Beer’s analysis did not speculate on who may be behind the attack, nor how lucrative the tool may have been on the black market. Some “zero day” attacks can be sold for several millions dollars – until they’re discovered and fixed.